From 4b2b4af606237def78273a42e881ae9f971cb505 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 4 Nov 2026 01:29:57 +0100
Subject: net: block private and link-local URLs

---
 src/tasks/mod.rs | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'src/tasks')

diff --git a/src/tasks/mod.rs b/src/tasks/mod.rs
index 362db80..c895a1b 100644
--- a/src/tasks/mod.rs
+++ b/src/tasks/mod.rs
@@ -122,6 +122,12 @@ async fn execute_audio_job(ctx: &CronContext, job: &crate::database::CronJob) {
     // job may point at an arbitrary third-party URL and must never receive
     // the password.
     let url = ctx.copyparty.build_url_for(audio_url);
+    if !ctx.copyparty.is_own_url(&url)
+        && let Err(e) = crate::net::ensure_public_http_url(&url).await
+    {
+        error!("Cron audio job {} refused URL: {e}", job.id);
+        return;
+    }
     info!(
         "Cron audio job {} playing: {}",
         job.id,
-- 
cgit v1.2.3